Bug 446944 – <www-client/chromium-23.0.1271.97 multiple vulnerabilities (CVE-2012-{5139,5140,5141,5142,5143,5144})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Mike Gilbert 2012-12-12 02:55:44 UTC]

Release notes in URL.

[Comment 1 Mike Gilbert 2012-12-12 05:07:13 UTC]

Please stabilize.

=www-client/chromium-23.0.1271.97

[Comment 2 Agostino Sarubbo 2012-12-12 10:47:51 UTC]

x86 stable

[Comment 3 Agostino Sarubbo 2012-12-12 10:56:11 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2012-12-12 13:32:02 UTC]

stabilization done

security, please add to the existing glsa

[Comment 5 GLSAMaker/CVETool Bot 2012-12-13 01:23:58 UTC]

CVE-2012-5144 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5144):
  Google Chrome before 23.0.1271.97 does not properly perform AAC decoding,
  which allows remote attackers to cause a denial of service (stack memory
  corruption) or possibly have unspecified other impact via unknown vectors.

CVE-2012-5143 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5143):
  Integer overflow in Google Chrome before 23.0.1271.97 allows remote
  attackers to cause a denial of service or possibly have unspecified other
  impact via vectors related to PPAPI image buffers.

CVE-2012-5142 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5142):
  Google Chrome before 23.0.1271.97 does not properly handle history
  navigation, which allows remote attackers to execute arbitrary code or cause
  a denial of service (application crash) via unspecified vectors.

CVE-2012-5141 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5141):
  Google Chrome before 23.0.1271.97 does not properly restrict instantiation
  of the Chromoting client plug-in, which has unspecified impact and attack
  vectors.

CVE-2012-5140 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5140):
  Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows
  remote attackers to cause a denial of service or possibly have unspecified
  other impact via vectors related to the URL loader.

CVE-2012-5139 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5139):
  Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows
  remote attackers to cause a denial of service or possibly have unspecified
  other impact via vectors related to visibility events.

[Comment 6 GLSAMaker/CVETool Bot 2013-09-25 00:10:32 UTC]

This issue was resolved and addressed in
 GLSA 201309-16 at http://security.gentoo.org/glsa/glsa-201309-16.xml
by GLSA coordinator Sean Amoss (ackle).